eschutho opened a new pull request, #41248:
URL: https://github.com/apache/superset/pull/41248
## Summary
### Deprecation warning
`authlib.jose` has been deprecated since authlib 1.3+ in favour of
`joserfc`. The library itself forces `AuthlibDeprecationWarning` visible at all
warning levels by calling `warnings.simplefilter("always",
AuthlibDeprecationWarning)` before emitting it. Our MCP service previously
imported four specific error subclasses directly from the deprecated path.
### What changed
**`superset/mcp_service/jwt_verifier.py`**
- Reduced from four `authlib.jose.errors` imports (`BadSignatureError`,
`DecodeError`, `ExpiredTokenError`, `JoseError`) to a single `JoseError` import.
- Tightened the header-parse except clause from `except (ValueError,
DecodeError)` to `except ValueError` — `_decode_token_header()` only raises
`ValueError` (via `base64.urlsafe_b64decode` → `binascii.Error` → subclass, and
`json.JSONDecodeError` → subclass).
- Merged the three separate decode-path except clauses into a single `except
JoseError as e:` block that discriminates by the `e.error` attribute value
(`"bad_signature"` → "Signature verification failed", `"expired_token"` →
"Token has expired (detected during decode)", else → "Token decode failed").
Attribute strings verified against authlib source.
**`superset/mcp_service/mcp_config.py`**
- Removed the `from authlib.jose.errors import JoseError` import entirely.
- Widened the verifier-construction fallback from `except (ValueError,
JoseError)` to `except Exception`. The handler already deliberately suppresses
exception details (they may contain key material); this also covers realistic
throws the old handler missed (`pydantic.ValidationError`,
`cryptography.*Error` from malformed keys).
The `warnings.filterwarnings` call in `__init__.py` is still needed (fastmcp
imports `authlib.jose` internally) and is unchanged.
### No behavior change
- All existing test assertions for `BadSignatureError`, `DecodeError`, and
`ExpiredTokenError` remain correct — the new handler routes each to the same
failure reason string via `e.error` attribute matching.
- The header-parse block change is safe: `_decode_token_header()` cannot
raise a `JoseError`.
## Test plan
- [ ] `pytest tests/unit_tests/mcp_service/test_jwt_verifier.py -x` — all
jwt_verifier tests pass
- [ ] `pytest tests/unit_tests/mcp_service/test_mcp_config.py -x` —
mcp_config tests pass
- [ ] Confirm no `AuthlibDeprecationWarning` leaks appear when running MCP
service tests (`-W error::DeprecationWarning` or checking test output)
🤖 Generated with [Claude Code](https://claude.ai/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
